Security audit

A security auditing tool for third-party Claude Code Skills. Automatically pre-checks any Skill before execution to block dangerous ones, and supports manual deep audits.

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed security checker, but it persistently changes Claude's global hook configuration and has fail-open gaps that can make its protection weaker than advertised.

Install only if you want a global Claude Code hook that runs this package's shell script before future Skill calls. Review the settings.json change first, keep the installed scripts protected from tampering, and do not rely on this as complete protection because some unresolved, namespaced, or nested-script cases can pass without full inspection.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/pre-check.sh:38
Finding: Unresolved and Namespaced Skills Bypass Automatic Security Inspection
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: install.sh:397
Finding: Installer May Silently Skip Security Hook Registration
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/pre-check.sh:58
Finding: Nested Script Directories Evade Automatic Security Scanning
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (59)

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 94% confidence
Finding: The skill explicitly states it will modify ~/.claude/settings.json to install a PreToolUse hook. Altering agent configuration is security-sensitive because it changes execution flow for future tool use and could persistently intercept, block, or influence agent behavior if the skill or its scripts are later tampered with.
Content: Scanner excerpt · README.md (reported line 39)May include surrounding context.
另外会修改：

text
~/.claude/settings.json # 添加 PreToolUse Hook 配置

安装

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 96% confidence
Finding: This installation step describes automatically merging a PreToolUse hook into ~/.claude/settings.json. Persistent hook registration materially expands the trust boundary of this skill because every future Skill invocation may execute its shell script, making any compromise in that script high impact.
Content: Scanner excerpt · README.md (reported line 55)May include surrounding context.
md
1. 创建 `~/.claude/skills/skill-security-check/` 目录 2. 写入 `SKILL.md`、`scan.sh`、`pre-check.sh` 3. 设置脚本执行权限 4. 将 PreToolUse Hook 合并到 `~/.claude/settings.json`（已有配置不会覆盖，原文件备份为 `.bak`）安装完成后**重启 Claude Code 会话**即可生效。

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 94% confidence
Finding: The manual install instructions direct the user to add a command hook in ~/.claude/settings.json that runs a local shell script on every Skill use. Even though the purpose is defensive, this is privileged agent configuration and becomes dangerous if the script is modified, replaced, or abused to interfere with normal operation.
Content: Scanner excerpt · README.md (reported line 78)May include surrounding context.
bash
chmod +x ~/.claude/skills/skill-security-check/scripts/*.sh

编辑 ~/.claude/settings.json，添加 Hook 配置：
json
{ "hooks": {

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · README.md (reported line 198)May include surrounding context.
Additionally modifies:

text
~/.claude/settings.json # Adds PreToolUse Hook configuration

Installation

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · README_EN.md (reported line 40)May include surrounding context.
Additionally modifies:

text
~/.claude/settings.json # Adds PreToolUse Hook configuration

Installation

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · README_EN.md (reported line 197)May include surrounding context.
Additionally modifies:

text
~/.claude/settings.json # Adds PreToolUse Hook configuration

Installation

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: The documented installation flow says the script automatically merges a PreToolUse hook into ~/.claude/settings.json, creating a persistent interception point that runs on every skill invocation. Even if intended as a security feature, automatic modification of agent configuration introduces a powerful persistence mechanism and expands the trust boundary to shell scripts installed from a third party.
Content: Scanner excerpt · README_EN.md (reported line 56)May include surrounding context.
md
1. Creates `~/.claude/skills/skill-security-check/` directory 2. Writes `SKILL.md`, `scan.sh`, and `pre-check.sh` 3. Sets executable permissions on scripts 4. Merges PreToolUse Hook into `~/.claude/settings.json` (existing config is preserved, original file backed up as `.bak`) **Restart Claude Code session** after installation to activate.

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: The manual installation instructions direct the user to add a command hook to ~/.claude/settings.json that executes a shell script automatically for every matched skill event. Hooking a global config to invoke shell code is inherently sensitive because a compromised or buggy script gains recurring execution in the agent workflow.
Content: Scanner excerpt · README_EN.md (reported line 77)May include surrounding context.
bash
chmod +x ~/.claude/skills/skill-security-check/scripts/*.sh

Edit ~/.claude/settings.json and add the Hook configuration:
json
{ "hooks": {

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · README.md (reported line 132)May include surrounding context.
md
|-------|------------------|-------| | Dangerous dynamic injection | SKILL.md contains curl/wget/ssh in dynamic injection syntax | CRITICAL | | Data exfiltration | Scripts pipe output to curl/nc | CRITICAL | | Remote code execution | Scripts contain curl \| bash pattern | CRITICAL | | Sensitive files + network | Scripts access .ssh/.aws/.env AND have network requests | CRITICAL | | Invisible characters | SKILL.md contains zero-width characters (possible prompt injection) | CRITICAL | | Auto-execute hooks | Frontmatter defines lifecycle hooks | WARNING |

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · README_EN.md (reported line 131)May include surrounding context.
md
|-------|------------------|-------| | Dangerous dynamic injection | SKILL.md contains curl/wget/ssh in dynamic injection syntax | CRITICAL | | Data exfiltration | Scripts pipe output to curl/nc | CRITICAL | | Remote code execution | Scripts contain curl \| bash pattern | CRITICAL | | Sensitive files + network | Scripts access .ssh/.aws/.env AND have network requests | CRITICAL | | Invisible characters | SKILL.md contains zero-width characters (possible prompt injection) | CRITICAL | | Auto-execute hooks | Frontmatter defines lifecycle hooks | WARNING |

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 133)May include surrounding context.
md
| Dangerous dynamic injection | SKILL.md contains curl/wget/ssh in dynamic injection syntax | CRITICAL | | Data exfiltration | Scripts pipe output to curl/nc | CRITICAL | | Remote code execution | Scripts contain curl \| bash pattern | CRITICAL | | Sensitive files + network | Scripts access .ssh/.aws/.env AND have network requests | CRITICAL | | Invisible characters | SKILL.md contains zero-width characters (possible prompt injection) | CRITICAL | | Auto-execute hooks | Frontmatter defines lifecycle hooks | WARNING |

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README_EN.md (reported line 132)May include surrounding context.
md
| Dangerous dynamic injection | SKILL.md contains curl/wget/ssh in dynamic injection syntax | CRITICAL | | Data exfiltration | Scripts pipe output to curl/nc | CRITICAL | | Remote code execution | Scripts contain curl \| bash pattern | CRITICAL | | Sensitive files + network | Scripts access .ssh/.aws/.env AND have network requests | CRITICAL | | Invisible characters | SKILL.md contains zero-width characters (possible prompt injection) | CRITICAL | | Auto-execute hooks | Frontmatter defines lifecycle hooks | WARNING |

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.md (reported line 196)May include surrounding context.

Remove the Skill directory:
bash
rm -rf ~/.claude/skills/skill-security-check

Edit ~/.claude/settings.json and remove the PreToolUse entry with matcher Skill

Restart Claude Code session

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README_EN.md (reported line 195)May include surrounding context.

Remove the Skill directory:
bash
rm -rf ~/.claude/skills/skill-security-check

Edit ~/.claude/settings.json and remove the PreToolUse entry with matcher Skill

Restart Claude Code session

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.md (reported line 196)May include surrounding context.

Remove the Skill directory:
bash
rm -rf ~/.claude/skills/skill-security-check

Edit ~/.claude/settings.json and remove the PreToolUse entry with matcher Skill

Restart Claude Code session

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README_EN.md (reported line 195)May include surrounding context.

Remove the Skill directory:
bash
rm -rf ~/.claude/skills/skill-security-check

Edit ~/.claude/settings.json and remove the PreToolUse entry with matcher Skill

Restart Claude Code session

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill’s declared purpose is a read-only security audit, but its behavior includes executing a local shell script as part of processing. That creates a material trust-boundary violation: users enabling an auditor reasonably expect passive inspection, not code execution, especially when the target path is attacker-controlled.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The instructions explicitly run bash ${CLAUDE_SKILL_DIR}/scripts/scan.sh "$ARGUMENTS", which means the auditing skill executes code rather than only inspecting files. Because the script is invoked on a user-supplied path, any unsafe handling inside that script could expose the user to command execution, unintended file access, or misleading audit results.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill contains contradictory instructions: earlier it requires executing a shell script, while later it says to never execute code from the audited skill. This inconsistency is dangerous because it can mislead operators into thinking the workflow is non-executing when it is not, undermining informed consent and safe use.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The installer writes multiple files under ~/.claude, including SKILL.md, helper scripts, and settings.json, so it clearly has file-write capability. That capability is central to the installer's behavior and becomes security-relevant because it alters persistent agent configuration and runtime behavior, not just local skill assets.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The installer writes multiple files under ~/.claude, including SKILL.md, helper scripts, and settings.json, so it clearly has file-write capability. That capability is central to the installer's behavior and becomes security-relevant because it alters persistent agent configuration and runtime behavior, not just local skill assets.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The installer registers a global PreToolUse hook for all Skill calls, which expands behavior from a manual auditing utility into an always-on interception mechanism. This creates persistent, auto-executing control over future skill use and can affect unrelated workflows, increasing blast radius if the hook is flawed, bypassed, or later modified.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Modifying ~/.claude/settings.json to install an auto-executing hook changes the user's global Claude behavior in a persistent way that is not necessary to perform ad hoc skill scans. This is dangerous because it grants the installer ongoing influence over future tool invocations and normalizes silent configuration changes in a security-sensitive agent environment.
Content: No source excerpt is available for this finding.

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 94% confidence
Finding: Direct access to ~/.claude/settings.json is sensitive because that file governs agent behavior, hooks, and potentially trust boundaries. Writing to it allows persistent modification of how Claude tools are invoked, which is powerful enough to create security or integrity issues even without OS-level privilege escalation.
Content: Scanner excerpt · install.sh (reported line 401)May include surrounding context.
sh
python3 << 'PYEOF' import json, os settings_file = os.path.expanduser("~/.claude/settings.json") with open(settings_file, "r") as f: settings = json.load(f)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · install.sh (reported line 201)May include surrounding context.
sh
# Check 3: Sensitive file access echo "--- Check 3: Sensitive File Access ---" if grep -rn -iE '\.ssh/|\.aws/|\.env|credentials|\.gitconfig|\.npmrc|\.pypirc|id_rsa|id_ed25519|\.kube/|\.docker/' "$SKILL_DIR" 2>/dev/null; then echo "[!] Sensitive file access patterns found above" else echo "[OK] No sensitive file access patterns found"

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Agent Config Directory Access

安装

Agent Config Directory Access

Agent Config Directory Access

Agent Config Directory Access

Installation

Agent Config Directory Access

Installation

Agent Config Directory Access

Installation

Agent Config Directory Access

Agent Config Directory Access

External Script Fetching

External Script Fetching

Credential Access

Credential Access

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tp4

Description-Behavior Mismatch

Intent-Code Divergence

Lp1

Lp1

Description-Behavior Mismatch

Context-Inappropriate Capability

Agent Config Directory Access

Credential Access

Static analysis